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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event. N)wever. may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 
' Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 

Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )n Responsive to communication{s) filed on . 

2a)n This action is FINAL. 2b)^ This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 6.7,12 and 18 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) S Claim(s) 6.7 and 12 is/are allowed. 

6) S Claim(s) 18 is/are rejected. 

Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) 0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing{s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121(d). 

1 1) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * 0)0 None of: 

1 .□ Certified copies of the priority documents have been received. 

2.n Certified copies of the priority documents have been received in Application No. . 



3.n Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 
Claim Rejections - 35 USC §103 

1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claim 18, is rejected xmder 35 U.S.C. 103(a) as being impatentable over (Y erxa and 
Karve) in view of Bott. 

3. As per claims 18, Yerxa teaches that Java has a Java Virtual Machine, the Java thread is 
inherent in Yerxa because Yerxa teaches Java, that consists of three parts, one of which is the 
security manager(SM, i.e. security association manger). Yerxa teaches that the security manger 
monitors file access, system I/O, network I/O, etc. . .(see, pg. 2). Further, Yerxa teaches that 
when an applet performs one of the above actions, it first consuhs the SM for approval(see pg. 
2). Also, Yerxa teaches that the SM decides if the action is permissible based on the origin of 
the application or applet(see pg. 2). Therefore, the Examiner asserts that Yerxa provides security 
against unauthorized access when the applet performs one of the above actions. Yerxa teaches 
that whenever a possibly dangerous fimction is called from within the applet or application, the 
SM grants or denies access to specific resources based on the origin of the application or applet. 
Further, Yerxa teaches that the administrator can restrict access to an applet based on its digital 
signature. Therefore, the Examiner asserts that security manager determines the origin of the 
application by checking the digital signature. The Examiner asserts that Yerxa teaches receiving 
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a digital signature at a security manager, because the security manger determines the origin of 
the application, and Yerxa teaches that applications have digital signatures, thus Yerxa teaches 
receiving a digital signature at a security manger. Yerxa teaches certain applets are given more 
access based on where they reside in the computer(see pg. 2). Yerxa also teaches that users may 
grant more access to certain applets. Therefore, the Examiner asserts that Yerxa does disclose 
access levels. The Examiner asserts that Yerxa does disclose a digital signature associated with 
the applet(see pg. 3). Therefore, an applet is associated with an access level. The Examiner 
asserts that a downloadable file is an applet or application, and Yerxa taught above teaches of 
digital signatures. 

4. Although, Yerxa is silent on the code or key that is used with a digital signature. The 
Examiner takes Official Notice that it is well-known in the art of digital signatures, that a key(i.e. 
code) pair is used for encryption and decryption, the motivation is that integrity is insured 
because one would need the corresponding key in order to decrypt. Proof that a digital signature 
has a corresponding pair can be taught in Karve. Karve teaches that an applet with a digital 
signature a public and private key. Also, Karve teaches that something can be encrypted with a 
public key, and decrypted with a corresponding private key(see pg. 3 of Karve). Therefore, the 
Examiner asserts that Karve teaches an encryption code and de-encryption code. 

5. Further, Karve discloses that the browser verifies the code and then the JVM allows the 
applet to run on the client machine. The Examiner asserts that the security manager is inside of 
the browser. Furthermore, the SM authenticates the de-encrypted digital signature, because 
Karve states that the browser verifies the code, and the code as taught in Yerxa and Karve has a 
digital signature, than the Examiner asserts Yerxa and Karve teach that the SM authenticates the 
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de-encrypted digital signature; and the SM de-encrypted the digital signature with the de- 
encryption code(see above for explanation). 

6. However, Yerxa and Karve are silent on the SM requesting a de-encryption code, and 
requesting allowed operations associated with the authenticated signature. The Examiner looks 
towards Bott. It would have been obvious to modify Yerxa and Karve with Bott, the motivation 
is that how does the security manager know the certificate is legitimate? Bott teaches that the 
certificate authority checks the digital signature on the certificate against the secure certificate it 
originally issued. Furthermore, Bott teaches that if the certificate is valid the browser used the 
key(i.e. code) to do whatever task. Therefore, the Examiner asserts that Bott teaches SM 
requesting a de-encryption code, because the CA(i.e. certificate authority) in Bott has the 
corresponding key(i.e. de-encryption code), and the browser uses this code to perform task or 
allowed operations(see Bott). 

7. Claims 6-7, 12, are allowable for the feature of a policy server receiving a request for 
allowed operations associated with the digital signature, comparing the authenticated signature 
with information stored on the policy server; and policy server sending a response to the SAM 
indicating an access level corresponding to the authenticated signature. As per prior art of 
Yerxa, Bott, and Karve, none of these teach the limitations above. More specifically, in prior art, 
and specifically the art that was appHed fails to disclose a policy server, the art discloses a 
security manager(S AM) that receives all code, and has a digital signature associated with it, the 
SAM denies and allows request to resources based on the origin of the code, in prior art there is 
no suggesting or disclosing of a policy server cooperating with the SAM, the SAM handles all 
comparing of the signature, and determining of the access level, because especially in the prior 
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art of Java the SAM executes inside the sandbox, and the SAM monitors the code. Proof of the 
SAM performing security pohcies with TVM can be found in Zhong et al. 
applet(see pg. 3). Therefore, an applet is associated with an access level. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jenise E Jackson whose telephone number is (703) 306-0426. 
The examiner can normally be reached on M-Th (6:00 a.m. - 3:30 p.m.) altemate Friday's. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-0040 for regular 
communications and (703) 308-6306 for After Final commimications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 305-3900. 



Conclusion 
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